Skip to content
Sign in
Not rated

CVE-2022-23048 Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP…

Description

Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it. After upload it, the PHP file will be placed at "themes/simpletheme/{rce}.php" from where can be accessed in order to execute commands.

Affected products and versions

Product Affected versions Fixed in
Exponent CMS 2.6.0patch2 No fix stated

Other CVEs of Exponent CMS

The 3 CVEs of Exponent CMS →
CVE-2022-23049 Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header… Not rated CVE-2022-23047 Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code inside the… Not rated
Track this CVE